fix(deploy): drop nonexistent 'seat' supplementary group

systemd refuses to spawn the unit with code=216/GROUP when any group in
SupplementaryGroups= doesn't exist. Debian's seatd uses -g video — there
is no 'seat' group on the system. Removing it lets cage start; the video
group already covers seatd access.

deploy/scripts/setup-pi-kiosk.sh

@@ -164,7 +164,9 @@ if [ "${INSTALL_KIOSK}" = "1" ]; then
   if ! id -u bfkiosk >/dev/null 2>&1; then
     useradd -m -s /usr/sbin/nologin bfkiosk
   fi
-  for grp in video render input audio seat; do
+  # Debian's seatd uses -g video (no separate 'seat' group) — only join groups
+  # that actually exist on this system.
+  for grp in video render input audio; do
     if getent group "$grp" >/dev/null; then
       usermod -a -G "$grp" bfkiosk
     fi

deploy/systemd/betterframe-kiosk.service

@@ -10,7 +10,7 @@ After=getty@tty1.service
 Type=simple
 User=bfkiosk
 Group=bfkiosk
-SupplementaryGroups=video render input audio seat
+SupplementaryGroups=video render input audio
 PAMName=cage
 TTYPath=/dev/tty1
 TTYReset=yes